(1) So I see all four vlans going to the switch, no problem there.
It could be shortened to one rule.
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,eth2_ext_switch vlan-ids=10,20,30,99
(2) What does not make sense to me at all is your interface list membership.
Does this makes sense to you.
BASE VLAN = MANAGEMENT VLAN correct?
Where all managed devices get their IP address correct?
Then why is WINBOX access, an admin management function given to employee vlan, lighspeed vlan and entire bridge but not the Base VLAN?
If you are serious about security
a. bridge gets nothing as its not a player once doing all vlans so bridge1 entries can and should be removed from interface list members config !
b. only Winbox Access list member should be the BASE VLAN and thefore THERE IS NO REQUIREMENT for winbox access list, you ONLY NEED the base vlan list,
so REMOVE winbox access totally!!.
(3) YOu have no dhcp_server network for BASE VLAN???
You have no dhcp server network for Employee vlan ???
Not sure of the purpose of the bridge subnet … very confused is this the home LAN??
if so, then give it its own vlan like vlan5.
You have no ports on the 2011 active except ether2 to the switch, so very confused with the setup.
I would personally enable ether10 and make it an off bridge access like the hapac… safer spot to do configuring!!
(4) You have no IP pool for BASE VLAN???
No IP pool for your weird bridge subnet???
(5) Conclusion REMOVE bridge from ip address, and interface lists, it serves no purpose and you config is a mixup of both!!!
/interface ethernet
set [ find default-name=ether1 ] name=eth1_WAN
set [ find default-name=ether2 ] name=eth2_ext_switch
set [ find default-name=ether4 ] disabled=yes
set [ find default-name=ether5 ] disabled=yes
set [ find default-name=ether6 ] disabled=yes
set [ find default-name=ether7 ] disabled=yes
set [ find default-name=ether8 ] disabled=yes
set [ find default-name=ether9 ] disabled=yes
set [ find default-name=ether10 ] disabled=no name=Off-Bridge10
set [ find default-name=sfp1 ] disabled=yes
/interface list
add name=WAN
add name=LAN
add name=BASE
/ip pool
add name=dhcp_pool_guest ranges=192.168.88.20-192.168.88.250
add name=dhcp_pool_lightspeed ranges=192.168.7.120-192.168.7.254
add name=dhcp_pool_base ranges=192.168.0.5-192.168.64.254
add name=dhcp_employee_vlan ranges=192.168.1.5-192.168.1.254
/ip dhcp-server
add address-pool=dhcp_pool_guest interface=GuestWIFI_VLAN lease-time=2h59m name=dhcp_server_guest
add address-pool=dhcp_pool_lightspeed interface=Lightspeed_VLAN lease-time=23h59m59s name=dhcp_server_lightspeed
add address-pool=dhcp_pool**base** interface=bridge1 lease-time=1h name=dhcp_serverbase
add address-pool=dhcp_pool**employee** interface=bridge1 lease-time=12h name=dhcpemployee
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,eth2_ext_switch vlan-ids=10,20,30,40
/interface list member
add interface=eth1_WAN list=WAN
add interface=Employee_VLAN list=LAN
add interface=GuestWIFI_VLAN list=LAN
add interface=Lightspeed_VLAN list=LAN
add interface=BASE_VLAN list=LAN
add interface=Off-Bridge10 list=LAN
add interface=BASE-VLAN=BASE
add interface=Employee_VLAN list=BASE comment=“limited by source IP in firewall address list”
add interface=Off-Bridge10 list=BASE
/ip address
add address=x.x.x.x/24 interface=eth1_WAN network=x.x.x.x
add address=192.168.0.1/24interface=BASE_VLAN network=192.168.0.0
add address=192.168.1.1/24 interface=Employee_VLAN network=192.168.1.0
add address=192.168.88.1/24 interface=GuestWIFI_VLAN network=192.168.88.0
add address=192.168.7.1/24 interface=Lightspeed_VLAN network=192.168.7.0
add address=192.168.55.1/30 interface=Off-Bridge10 network=192.168.55.0
/ip dhcp-server network { dont add netmask manually }
add address=192.168.7.0/24 comment=“DHCP for Lightspeed” dns-server=8.8.8.8,192.168.7.1 gateway=192.168.7.1
add address=192.168.0.0/24 comment="DHCP for Base" dns-server=8.8.8.8,8.8.4.4 gateway=192.168.0.1
add address=192.168.88.0/24 comment=“DHCP for Guests” dns-server=8.8.8.8,8.8.4.4 gateway=192.168.88.1
add address=192.168.1.0/24 comment=“DHCP for Employees” dns-server=8.8.8.8,8.8.4.4 gateway=192.168.1.1
Looking at Firewall rules, there is no requirement for anyone not on BASE VLAN to access the router.
If you need separate access because the admin is working normally from non base vlan, VLAN, then use source address list appropriately, not blanket inclusion to many!!!
Certainly cannot agree with allowing the complete guest vlan to be on the allowed to router???
/ip firewall address-list { via static dhcp leases }
add address=192.168.0.0/24 list=allowed_to_router comment=“entire BASE VLAN subnet”
add address=192.168.1.XX /32 list=allowed_to_router comment='admin pc on employee subnet"
add address=192.168.55.2/32 list=allowed_to_router comment=“admin off bridge access on ether10”
/ip firewall filter
{ default rules to keep }
add action=accept chain=input comment=“Allow Estab & Related” connection-state=established,related,untracked
add action=drop chain=input comment=“drop invalid” connection-state=invalid log=yes log-prefix=invalid
add action=accept chain=input comment=“accept ICMP” protocol=icmp
add action=accept chain=input comment=“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1 log=yes log-prefix=“accept local loopback CAPsMAN”
{ admin rules }
add action=accept chain=input comment="Admin ONLY access to Router" in-interface-list=BASE src-address-list=allowed_to_router
add action=accept chain=input comment=“Allow VLAN to DNS/NTP-UDP” dst-port=53,123 in-interface-list=LAN protocol=udp
add action=accept chain=input comment=“Allow VLAN to DNS-TCP” dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment=“Drop All Else” log-prefix=DROP-FIREWALL
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
{ default rules to keep }
add action=fasttrack-connection chain=forward comment=FastTrack connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=“accept established,related” connection-state=established,related,untracked
add action=drop chain=forward comment=“drop invalid” connection-state=invalid log=yes log-prefix=invalid
{ admin rules }
add action=accept chain=forward comment=“internet access” in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment=“port forwarding” connection-nat-state=dstnat enabled=yes { disable or remove if not required }
add action=drop chain=forward dst-address=77.66.21.133 in-interface-list=LAN disabled=yes { disabled as no sense of purpose of rule? why this rule?? }
add action=drop chain=forward in-interface-list=BASE src-address-list=allowed to router out-interface-list=LAN comment=“admin access to all vlans”
add action=drop chain=forward comment=“DROP All Else”
Nothing else is needed. If there are real issues due to FW, then can discuss adding more.
Where is NTP SERVER, you have client to the internet but you can serve to the hap and caps from router!!! so all are in same sync.
/tool mac-server mac-winbox
set allowed-interface-list=BASE
